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Abstract 

We improve the non-asymptotic key rate shown by Scarani and Ren- 
ner by proposing several methods to construct tighter conservative confi- 
dence intervals of the phase error rate than one shown by them. In addition, 
we show that the accurate channel estimation method non-asymptotically 
increases the key rate over the amplitude damping channel as well as the 
asymptotic case in the BB84 protocol. 



1 Introduction 

Quantum key distribution (QKD) has attracted great attention as a feasible appli- 
cation of quantum information science with the current device technology IfTOll . 
The goal of a QKD protocol is to share a random bit sequence not known by the 
eavesdropper Eve, between the legitimate sender Alice and the receiver Bob. The 
fundamental feature of QKD protocols is that the maximum amount of informa- 
tion gained by Eve can be determined from the channel estimate between Alice 
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and Bob. Such a task cannot be conducted in classical key distribution schemes. 
If the estimated amount is lower than a threshold, then Alice and Bob determine 
the length of a secret key from the estimated amount of Eve's information, and 
can share the secret key by performing the information reconciliation (error cor- 
rection) and the privacy amplification. Since the key rate, which is the length 
of securely sharable key per channel use, is one of the most important criteria 
for the efficiency of QKD protocols, the estimation of the channel is of primary 
importance. 

Conventionally in the Bennett-Brassard 1984 (BB84) protocol 0, we only 
use the statistics of matched measurement outcomes which are transmitted and 
received by the same basis, to estimate the quantum channel; mismatched mea- 
surement outcomes, which are transmitted and received by different basis, are 
discarded in the conventionally used channel estimation methods. By contrast, 
Watanabe et al. [30] showed that by using the statistics of mismatched measure- 
ment outcomes in addition to that of matched measurement outcomes, we can 
estimate a quantum channel more accurately, thereby a higher key rate can be 
achieved than the conventional one. However their analysis was only asymptotic, 
i.e., they assumed that the number of sample bits for channel estimation is infinite. 
Hence, for practical use, it is necessary to perform non-asymptotic analysis. 

For non-asymptotic analysis of the QKD protocol, Scarani et al. formulated 
a lower bound on secure key rate [|24l |25l . Other researches of non-asymptotic 
analysis was surveyed by Cai et al. Q. Since the formula by Scarani et al. has 
enough generality, in theory it enables us to calculate not only non- asymptotic key 
rate based on the conventional channel estimation but also the one based on the 
accurate channel estimation [|30l for the BB84 protocol. 

On the other hand, in Cai et al. [5] p.4], it was suggested that a lower bound 
on secure key rate shown by Scarani et al. might be able to be improved. In the 
channel estimation step shown by Scarani et al. the channel parameter is guessed 
by interval estimation. However, the method of constructing confidence region 
of the interval estimation is not unique. Even when we use the confidence region 
which is different from the one shown by Scarani et al. if it satisfies the condition 
of conservativeness, the security of the final key is guaranteed. Specifically, even 
if one-sided interval estimation is used, the security is still kept. 

In this paper, we show two things: First, we show several methods of recon- 
structing the confidence region, and the fact that they increase the non-asymptotic 
secure key rate in the BB84 protocol. Second, we show the utility of accurate 
channel method on the BB84 protocol using finite sample bits. To do this, we 
compare the non-asymptotic key rate based on the accurate channel estimate to the 
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conventional one by numerical computation over the amplitude damping channel 
and the depolarizing channel. 

We stress that the assumption used in this paper is exactly the same as ll24ll . In 
particular, we assume no prior knowledge of channel nor channel model with the 
accurate channel esitimation, as well as its asymptotic case 11301 . In the numerical 
comparison in Section [331 we shall use the depolarizing channel and the ampli- 
tude damping channel to generate the mesurement outcomes, but the proposed 
protocols do not assume the knowledge of the underlying channels, and estimate 
the channel among all the possible channels. 

The rest of this paper is organized as follows: We first review previously 
known results in Section [2] Second, we show several methods to improve the 
key rate and the results of the improvements in Section [3j Last, we state the con- 
clusion in Section |U 

2 Preliminaries 

2.1 BB84 protocol 

Typical one of the QKD protocols is the BB84 protocol invented by Bennett and 
Brassard [2J. The goal of the BB84 protocol is to share a random bit sequence 
not known by the eavesdropper Eve, between the legitimate sender Alice and the 
receiver Bob. In the following, we briefly describe the flow of the protocol and the 
accurate channel estimation shown by Watanabe et al. 11301 on the BB84 protocol. 

2.1.1 Overview of BB84 protocol 

BB84 protocol consists of the following four steps: 

i. Distribution of quantum information: Alice sends N quantum objects, for 
example photon polarizations, to Bob over a quantum channel. 

ii. Parameter (or channel) estimation: Alice and Bob disclose a part of the 
transmission/received information to each other to estimate the quantum 
channel between Alice and Bob. 

iii. Information reconciliation: For the bit string not disclosed in step HQ Alice 
sends the syndrome to Bob, and Bob corrects an error by using the syndrom. 
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iv. Privacy amplification: Alice and Bob compress corrected bit strings in step 
Hill according to the same hash function so that compressed bit string is sta- 
tistically independent of information obtained by Eve. Consequently, com- 
pressed bit string is the final key. 

The security of the final key obtained by BB84 protocol can be proven only by the 
axiom of quantum mechanics [|24ll25l . 

2.1.2 Accurate channel estimation 

In this section, we explain the distribution of quantum informationin and convena- 
tional parameter estimation more concretely. Moreover, we explain the accurate 
channel estimation shown by Watanabe et al. [3] on the BB84 protocol. 

Alice first randomly sends bit or 1 to Bob by modulating it into a trans- 
mission basis that is randomly chosen from the z-basis {|0 Z }, |l z )}, the x-basis 
{|0 X ), |l x )}> where |0 a ), |l fl ) are eigenstates of the Pauli matrix o a for a E {z,x}, 
respectively. Then Bob randomly chooses one of measurement observables a z , 
<7 X , and converts a measurement result +1 or —1 into a bit or 1 respectively. 
After N transmissions, Alice and Bob publicly announce their transmission bases 
and measurement observables. They also announce m(< N) bits of their bit se- 
quence for estimating channel Sg from Alice to Bob. Conventionally, Alice and 
Bob discard mismatched measurement outcomes, which are transmitted and re- 
ceived by different bases 11271 . In contrast, Watanabe et al. 11301 show that by 
using the statistics of mismatched measurement outcomes in addition to that of 
matched measurement outcomes, we can estimate a quantum channel more ac- 
curately, thereby the key rate is at least higher than the conventional one. In 
particular, the key rate is generally improved over the conventional one over any 
channel, and only if the quantum channel is the Pauli channel, those two key rates 
are equal ll29ll . 

2.2 Method of type 

In this section, we review the method of type [9, Chapter 1 1] that are used in this 
paper. Let be a finite set. For a sequence x m = (x\, . . .,x m ) e JT m , the type of 
x™ is the empirical probability distribution P x m defined by 

P x , n (a):= l{''l*' = fl }l foraG^T. 
m 

Then, the following theorems hold. 
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Theorem 1. [9, Theorem 11.2.1] Let Px be a probability distribution on and 
P x m be the type of the sequence x m drawn according to the m-fold product distri- 
bution P x l . Then, for any 8, 

Pr[D(P x ,«\\P) > ^] < 2 '"(S | — 2_ — ) 

where D(-) is the relative entropy. Note that the base of a logarithm and a (con- 
ventional) entropy are 2 throughout this paper. 

Lemma 1. fl9] Theorem 1 1.6.1] Let P and Q be probability distributions. Then 

||P-fi||i< V2(ln2)D(P||Q) 

where || • ||i is the variational distance defined by ||Pi — P2II1 := Y.xeS' \Pi( x ) ~ 
Pi{x)\, where P\,P2 are probability mass functions on 56 '. 

Corollary 1. Let P x m be the type of X. For any 8 > 0, 

r -1 1 5 2 I ay\ l°g2( m+1 ) ^ 

Pr[||P,m-P||i > 5]<2- m ^-m^^). 
2.3 Non-asymptotic key rate analysis 

In this section, we rephrase non-asymptotic key rate analysis shown by Scarani et 
al. Il2"5ll on the BB84 protocol in terms of interval estimation. This paraphrase is 
necessary to clarify the relation between the method shown by Scarani et al. and 
our proposed one. Note that interval estimation of a quantum channel for QKD 
protocols is also discussed in lfT4l[T5i 

2.3.1 Interval estimation 

Here we briefly review some basic concepts of the interval estimation. See text- 
books of statistics for more details (e.g. [6]). 

The goal of the interval estimation is to estimate the unknown statistical pa- 
rameter 9 by observed samples. First, we define the confidence region. Let a 
sample sequence X = X\,--- , X n ~ Pq be i. i. d. , and be the parameter space. For 
any a between and 1, if a set C(X) C satisfies 

\/9e®,P 6 [9eC(X)]> I- a, (1) 

then C(X) is called a confidence region. Specially, if 9 is real-valued, then C(X) 
is usually an interval of real numbers, sometimes called the confidence interval. 
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In addition, the real-number 1 — a is called the confidence level or confidence 
coefficient. If the inequality in Eq. (QQ) is always satisfied, i.e. 

Ve e0,Pe[0 eC(X)] > 1-a, 

then such C(X) is called a conservative confidence region. 

Second, we describe the one-sided interval estimation. Suppose that 9 is a 
real number. One-sided interval estimation is defined as constructing the upper 
bound on satisfying 

V9e®,P e [9<C(X)]>l-a. (2) 

The interval (— o°,C(X)] is called a one-sided confidence interval with confidence 
level I — a. Of course, if the inequality in Eq. (O is always satisfied, the interval 
(— °°,C(X)] is conservative. 

2.3.2 Channel estimation using finite sample bits 

One of the practical issues of QKD protocol is that sample bits used for channel 
estimation is limited to a finite number. Scarani et al. showed a method for interval 
estimation of the quantum channel [|24l l25l . Hereafter, the basis {|0), |1)} is the 
z-basis unless otherwise stated. 

The channel Sb, which denotes a qubit channel from Alice to Bob, can be also 
described by the Choi operator (HI p AB := (id <g) $b){\ VKvl) f° r tne Bell state 
I V> = 7f(|0>|0> + |1>|1». For any e PE (0 < e PE < 1), let ' 

^ / 21n(l/£/> £ ) + 2Jln(m+l) 

V m 
^ := {pAB'.\\Kn-h~{PAB)\\\<$}, 0) 

where X m are obtained by measurements of m samples of Pab according to a 
POVM measurement with d outcomes, and ^(Pab) denotes the perfect statis- 
tics in the limit of infinitely many measurements. Then r> can be interpreted 
as the conservative confidence region with confidence level 1 — £p E for the qubit 
channel Pab- Indeed, for any Pab, we can see 

Pr[||A„ ; -A 00 (p AS )|| 1 <^] > l-l-'^-d'^ 1 ) (4 ) 

= 1-epE 
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by Corollary Q] in Section [2T2l Note that the definition of variational distance used 
in this paper is the same as BUl and twice as large as the one used in [5] and that 
the right hand side of Eq. ((U) is twice as large as [5, Eq. (3)], where |H1 Eq. (3)] is 
corrected in its erratum. By the same argument as 0, we see that for d = 2 we 
can use 

/ ln(l/e P£ )+21n(m+l) 

/^observed + V ^ PJ 

as the worst-case estimate of the so-called phase error rate, where ^observed is 
the actually observed phase error rate. We shall use Eq. © in the numerical 
comparison in Section [331 



2.3.3 Lower bound on the secure key rate of the BB84 protocol 

First, we define e-security 03 |23]|. For any e > 0, a final key K is said to be 
e-secure with respect to an adversary Eve if the joint state Pke satisfies 

\\Pke-?k®Pe\ \ < e, 

where Xk is the completely mixed state on a key space S^k, and 1 1 • 1 1 is the trace 
distance. The parameter e can be interpreted as the maximum failure probability 
in which an adversary might have gained some information on K. 

Next, we describe the lower bound on the e-secure key rate of the BB84 pro- 
tocol using finite samples shown by Scarani et al. Il25l . If the length / of the final 
key is 

I = N[ min S PAB (X\E) - 5(e)] -leak ££C - 21og 2 -L (6) 

Pab&b, £pa 

then the final key is e-secure, where S Pab (X\E) is the conditional von Neumann 
entropy for the state Pab, and is the confidence region for Pab with the con- 
fidence level 1 - e PE , and e > Epe- See EH |2H for more detail of Eq. ©. This 
formula enables us to calculate the non- asymptotic key rate based on the accurate 
channel estimate and the conventional one for the BB84 protocol respectively. 

Remark 1. Eve's ambiguity for Alice's bit S Pab (X\E) can be calculated from 
the Choi operator Pab as follows. Let the density operator Pxb be derived by 
measurement on Alice's system, i.e., Pxb '■= ExeF 2 I ® I)Pab(\x)(x\ <S>/). 
The conditional von Neumann entropy S Pab (X\E) is defined by S Pab (X\E) : = 
S(Pxe) —S(Pe), where S(-) is the von Neumann entropy and pE is the partial 
trace of Wabe, which is the purification of Pab, over the joint system of Alice and 
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Bob. Noting that S Pab (X\E) = S Pab (X\B) and S(p E ) = S(p AB ), Sp AB (X\E) can be 
calculated by S Pab (X\E) = S(Pxb) -S(p AB ). 

3 Improvement of key rate 

In this section, we present several methods of improving the lower bound on the 
secure key rate by replacing the confidence region as shown in Eq. ©. In general, 
the smaller the confidence region Y^ is, the bigger Eve's worst-case ambiguity 
minr^ S Pab (X\E) can grow. Even when we use the confidence region which is 
different from Y^ , if it is conservative, the security of the final key is guaranteed. 
Hence, the lower bound in Eq. © can be improved by reconstructing the confi- 
dence region with confidence level 1 — £pe tighter than Y^ because the influence 
from the different channel estimation method appears only in Eve's worst-case 
ambiguity in Eq. ©. In addition, we clarify the utility of the accurate channel 
estimation method in the BB84 protocol using finite sample bits by numerically 
computing Eve's worst-case ambiguities over the amplitude damping channel and 
the depolarizing channel. 

We first present several methods for composing such confidence region in Sec- 
tion 13.11 Then we show how to compute Eve's worst-case ambiguity with the 
accurate channel estimation in Section 13 .21 Last we compare Eve's worst-case 
ambiguities by the proposed methods and the accurate channel estimation in Sec- 
tion [331 Hereafter, we distinguish the conventional channel estimation reviewed 
Section 12.1.21 and the conventional confidence region shown by Scarani et al. §5§ 
to avoid confusion. We call the former the conventional channel estimation, and 
the latter the conventional confidence region or merely Y^ . 

3.1 Reconstruction of confidence region 
3.1.1 Relative entropy 

Here, we reconstruct the confidence interval with confidence level 1 — £pe using 
the relative entropy. Let 

£/ ._ log 2 ( 1 fe PE ) + d log 2 (m + 1 ) 

m 

r§, := {pab:D(U\^(Pab))<^}, (7) 
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where £>(•) is the relative entropy (5]|. Then in the following, we prove that the set 
T^i is the conservative confidence region for p^g with confidence level 1 — £pe, 
and Y^i C Y?. 

Proof. From Theorem [H obviously 

r ,n HI jl°g?( m +l)\ 

Vx[D{X m \\X^p AB )) < !;'] > 

= 1-£pe 

Thus, Y^i is the conservative confidence region for p^g with confidence level 1 — 
£pe- In addition, let 



T] = D{X m \\X oa {p AB )) 

then 



\X m — Aoo(pAg)||l 

21n2 : 



||A m — Aoo(pab)IIi < 
^ Z)(A m ||Aoo(pAg)) < Z' + i] 

Thus, r,f can be rewritten as follows; 

= {pAB D{hm\\A~>(pAB)) <£' + ri}- 

From Lemma[H 77 > 0. Therefore, cr^. □ 

Hence, by replacing of Eq. © with Yp , we can surely gain a higher key 
rate than the conventional one. 



3.1.2 Binomial one-sided confidence bounds 

Here we describe a general method for converting an upper bound on the tail 
probability of the binomial distribution B(m,p) into the conservative one-sided 
confidence interval for p with confidence level 1 — £pe, where m is the number of 
Bernoulli trials and p is the probability of success on each trial. In the conven- 
tional channel estimation, Eve's worst-case ambiguity can be calculated by the 
estimated phase error rate 11221 . We can use the one-sided interval estimation j6]| 
to guess the phase error rate. The one-sided interval estimation for phase error 
rate is equivalent to that for p of binomial distribution B(m,p), which can be per- 
formed by converting an upper bound on the tail probability of B(m,p). Thus we 
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describe such a method. In addition, we enumerate concretely some upper bounds 
for 5(m, p), and show that one-sided confidence intervals gained by those bounds 
can increase Eve's worst-case ambiguity compared with Eqs. © and ©. 

Hereafter, X be a random variable according to Px = B(m, p) , and X = X/m. 

i. Preliminary : First of all, we describe the general converting method. Our 
goal is to construct the one-sided confidence interval, i.e. calculating the 
upper bound C(X) similar to Eq. ©. Assume that 8 is an arbitrary real 
number between and p, and u{m,p,8) is a real-valued function. Then 
an upper bound on the tail probability of the binomial distribution can be 
generically described as 

Px[X <p-S]<u(m,p,8). 

Thus, by a straightforward calculation, we can show 

Px[p<X + 8]>l-u(m,p,8). (8) 

In Eq. ©, by setting 8 as u{m,p, 8) — £pe for all p and given m, we can 
regard Eq. © as the conservative one-sided confidence interval with con- 
fidence level 1 — £pe, thereby C(X) = X + 8 in Eq. ©. Moreover, we can 
calculate C(X) from the function u, the sample size m, and the realization 
of X as follows. From the fact that u(m,p, 8) = £pe for any p, we have 

u(m,C(X),C(X)-X) = £ PE . (9) 

By regarding the left-hand side of Eq. © as a function of C(X), i.e. u mX (C(X)) := 
u(m,C(X),C(X) -X), we get 

u m ^C{X)) = £ PE (10) 
& C(X) = u m ^(£ PE ). (11) 

Therefore, we can calculate C(X). Note that the inverse function of u m % 
exists since it is generally monotonically decreasing function on [X, 1]. Fur- 
thermore, the tighter the function u mX is, the smaller the value of C(X). 
Therefore, we can construct a smaller confidence interval by using the tighter 
bound u m £. 

ii. Chernoff bound Q : For any < 8 < p, Chernoff bound is described by 

Px [X < p - 8] < 2-' nD ^- 5 ^P\ (12) 
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By considering u(m,p, 8) = 2 mD ^ p 8 Wp), we can gain 

u m ^(C(X))=2- mD ^ c ^\ (13) 

Thus we can calculate C(X) in the same manner as Eq. (fTTI) . 
On the other hand, from Eqs. (flOl) and (fT3l) . we have 



2 -mD(X\\C(X)) _ £p£ 

O D(X\\C(X)) = \og 2 (l/£ PE )/m. (14) 

Moreover, the right-hand side of Eq. (PT41) is smallar than , that is, 

log 2 (l/£ P£ )/m<<f. 

Hence we can see that the confidence interval [0,C(X)] by Chernoff bound 
is tighter than Fpi by comparing Eq. (fl4l) with Eq. ©. 

Factorial moment bound [21] : For any < 8 < p, the factorial moment 
bound is described by 

where? = m(l — p + 8) and \i =m(l — p), andn* = [(? — . Therefore, 
by considering 

M(m ' P ' 5) = r(r-l)...(f-„*) ' 

we can compute C(X) as well as Chernoff bound. 

Since the upper bound in Eq. (fT5l) is tighter than the one in Eq. (fT2l) [fT9l , 
the value of m _ V(£pf) » which is calculated from the fractional moment 
bound is smaller than the one from Chernoff bound, thereby the confidence 
interval by the fractional moment bound is also tighter. 

Klar bound lfT2l : Let 

f x :=( m x ^j{l-p) x p m - x (0<x<m). 
Then for any < 8 < p, Klar bound is described by 

Px(x< P s)< ( " + '>'; n . /„, 

n + 1 — (m+l){l—p) 
11 



where n = m( l — p + 8). Thus, we can calculate C(X) by setting 

t r\ (n + l)p 

u(m,p,d) = —— — r/ n . (16) 

n + l — (m + l)(l — p) 

In Eq. (fT6l) . if m is very large, it is difficult to compute the binomial coef- 

. To calculate this value, we can use the following lemma. 

n J 

Lemma 2. [17, Lemma.7, p. 309] Suppose m and n(< m) are integers. Then 

m \ < \ 2 ml < x ) 

n ) ~ y/2nm\{l-X) 

where A = n/m, and h(-) is the binary entropy. 

3.2 Computing with the accurate channel estimation 

The computation method of Eve's worst-case ambiguity minp AB£ r^ S Pab (X\E) in 
Eq. © with accurate channel estimation using finite sample bits has not been 
clarified. Therefore, we show how to compute it in this section. 

First of all, observe that the formula © found by Scarani and Renner [|24ll25ll 
is so general that we can also just apply Eq. © to the the accurate channel estima- 
tion. There is no need to develop a new analysis for the accurate channel estima- 
tion with finite samples. So we need to numerically compute minp Age r> S Pab (X \E) 
in Eq. ©. However, we use of Eq. © instead of Y^. There are two reasons 
for this choice. Firstly, is smaller than r> as shown in Section |3. and we 
have min pAge r>, S Pab (X\E) > min pABer ^ S PAB (X\E). Secondly, we can differenti- 
ate the mathematical expressions in T^i and the differentiability often helps the 
numerical optimization. 

An analytical computation of Eve's worst-case ambiguity may be impossible. 
Therefore, to obtain this value, it is necessary to solve the following minimization 
problem: 



minimize 
subject to 



S PAB (X\E) (17) 
Pab is a rea l Choi matrix 
Pab e 



Note that when p& B is the real matrix, the optimum value of Eq. (flTT) among all 
the complex Choi matrices is achieved by Proposition 1 of [|30l . This allows us to 
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restrict the range of minimization to real matrices. Without Proposition 1 of 11301 
the range of minimization must be complex matrices. 

Fortunately, this problem is a convex optimization because the objective func- 
tion S Pab (X\E) is a convex with respect to Pab ll30l and T^i is a convex set. Note 
that the convexity of r>/ can be easily proved by facts that a sublevel set of a con- 
vex function is convex [|4]| and the relative entropy is convex [9|. Hence, we can 
compute the global optimum value of Eq. (fTTT ). 

Remark 2. A standard algorithm to solve a constrained minimization problem 
like Eq. (fTTT) is the interior-point method (e.g. see 01), and the gradient and 
the Hessian of the objective function are usually required to use this algorithm. 
In Eq. (fTTT) . however, it is difficult to calculate those of the objective function 
Sp AB (X\E) because S Pab (X\E) is the function that depends on eigenvalues of 4 x 
4 matrices. To calculate those derivatives, we can use the method for spectral 
functions. The gradient can be handily derived by using Theorem 1.1 of lfT6l . and 
the Hessian by Proposition 6.6 of ll26ll . 

Remark 3. The interior-point method requires a strictly feasible starting point, 
which means that the point strictly satisfies all the constraints. In particular, we 
should find the Choi operator Pab satisfied D(X m \ \ Xoo(Pab)) < for given X m and 
Since such a point is not known, we should solve another convex optimization 
problem, 

minimize : D(X m \\X oa ( Pab ) ) 
subject to : Pab is a real Choi matrix 

as a preliminary stage, called phase I [4J- Note that the starting point of this 
optimization can be an arbitary Choi matrix. The strictly feasible point found 
during phase I is then used as the starting point for the original problem, which is 
called the phase II. 

Remark 4. By switching the role of Alice and Bob in the information recon- 
ciliation step, we can sometimes asymptotically gain a higher key rate than the 
original procedure that is called the direct reconciliation [30]. Such a procedure is 
usually called the reverse reconciliation OHIO. A non-asymptotical key rate for 
the reverse reconciliation can be derived by replacing S Pab (X\E) of Eq. © with 
S Pab (Y\E) 11301 . For calculating the gradient and the Hessian of S Pab (Y\E), we can 
use the result in IfTTTl . 
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Remark 5. The optimization problem (fTTT ) can also be regarded as a semidefinite 
optimization with a nonlinear convex objective function. Recently, several meth- 
ods have been proposed for solving such kind of the optimization problem, for 
example, lfT3ll28ll32ll3"TTl . In the numerical computation in Section [331 we used 
the method proposed in lfT3~ll28ll . 



3.3 Comparison of Eve's worst-case ambiguities 

The influence from the different channel estimation method appears only in Eve's 
worst-case ambiguity in Eq. ©. Therefore, we can compare the secure key rates 
only by Eve's worst-case ambiguities. 

In Section 13 . 1 1 we showed in theory that the confidence interval is smaller in 
the following order: T^, T^, the one-sided confidence interval by using Chernoff 
bound, the one-sided confidence interval by the factorial moment bound. There- 
fore, Eve's worst-case ambiguities grow also in this order in the conventional 
channel estimation. However, the relation between those confidence intervals and 
the one-sided confidence interval by using Klar bound is not clear. Thus, we com- 
pare Eve's worst-case ambiguities in the BB84 protocol by the proposed methods 
over the following channels: 

i. amplitude damping channel 

( Bz\ ( l-q \ / 6z \ ( q\ 

\ 9 X ^ V / W ][ Ox + , (18) 

\e Y J \ o o / V Oy J V / 



ii. depolarizing channel 




l-q 







f e z 





l-q 


• 


Bx 








l-q 


\ By 



(19) 



where (6z,6x,6y) describes the representation of a qubit vector in the Bloch 
sphere, and the channel parameter q is a real number between and 1 [|20l . Fur- 
thermore, we show computation results of Eve's worst-case ambiguity with the ac- 
curate channel estimation over those channels on Figs. Q] and [2l These values with 
the accurate channel estimation are computed by using MATLAB 2009bSPl and 
PENNON 1.0, which can be purchased from PENOPT GbR ( | www.penopt. c om ) . 
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We included the MATLAB routines of our numerical computation into the sup- 
plementary data to this article so that the scientific community can verify out 
results. Note that the horizontal axis in two figures indicates the sample size used 
to estimate each channels with the accurate channel method, and the vertical axis 
indicates Eve's worst-case ambiguity. 

Remark 6. In the conventional channel estimation, Eve's worst-case ambiguity 
is calculated as follows. Let p be the worst-case estimate of phase error rate with 
confidence level 1 — £pe, namely C(X) in Eq. 0, then Eve's worst-case ambiguity 
is well-known value 1 — h(p) [|22|. where h(-) is a binary entropy. 

Remark 7. The sample size for the accurate channel estimation is about four 
times as many as that for the conventional channel estimation in our comparison. 
This is because we estimate the channel by using measurement outcomes only 
when both Alice and Bob choose x-basis in the conventional channel estimation. 
While, in contrast, in the accurate channel estimation we estimate the channel by 
using all measurement outcomes when Alice and Bob choose the transmission 
basis and the measurement observable among x-basis and z-basis with probability 
1/2 respectively. 

Remark 8. In Figs. \T\ and |2l Eve's worst-case ambiguities with the conventional 
channel estimation are computed by assuming that empirical distribution X m is 
equal to theoretical distribution determined uniquely by Pab of each channel, be- 
cause the channel corresponding to any X m always exists. By contrast, in the 
accurate channel estimation, the channel corresponding to measured statistic X m 
does not necessarily exist [|33ll . Thus we compute Eve's worst-case ambiguities 
by A OT generated with the pseudo-random number generator, to keep fairness of 
the comparisons. 

3.4 Discussion 

From Figs. \T\ and [2l we can see two facts: First, our proposed confidence in- 
tervals improve non-asymptotically Eve's worst-case ambiguity over the conven- 
tional confidence region. The amount of the improvement by "conventional Klar" 
compared with "conventional variational" is about 1.1% at 10 7 samples in both 
figures. Klar bound is the larger than Chernoff bound and the factorial moment 
bound, though the differences are small. In addition, since convergences of these 
bounds are faster than that by , we can gain a higher key rate for fewer samples 
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Figure 1: (Color Online) Comparison of Eve's worst-case ambiguities in the 
BB84 protocol over the amplitude damping channel against the sample size with 
the accurate channel estimation, "accurate relative" is Eve's worst-case ambigu- 
ity with the accurate channel estimation obtained solving the convex optimiza- 
tion Eq. (TT7T ) (see Section 1X21) . Moreover, "conventional variational" and "con- 
ventional relative" are Eve's worst-case ambiguities with the conventional chan- 
nel estimation by Y^ and Ypi, "conventional Chernoff," "conventional moment," 
"conventional Klar" are ones by the one-sided confidence interval using respec- 
tive bounds (see Section [3 .1.21) . Note that "conventional Chernoff" and "conven- 
tional Moment" almost overlap. Parameters are the channel parameter q = 0.1 
(seeEq. <©), e PE = 10 5 . 

in which key rate with Y^ is small. For example from Fig. 2, when the sample 
size is 10 4 , we can see that the value by Y^ is about 0.56, in contrast, the value by 
Klar bound is about 0.67. Secondly, Eve's worst-case ambiguity with the accurate 
channel estimation is non-asymptotically much higher compared with all values 
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sample size 

Figure 2: (Color Online) Comparison over the depolarizing channel, "accurate 
relative" is Eve's worst-case ambiguity with the accurate channel estimation ob- 
tained solving the convex optimization Eq. (fTTI) (see Section 13.21) . Moreover, 
"conventional variational" and "conventional relative" are Eve's worst-case am- 
biguities with the conventional channel estimation by Y^ and Ytr, "conventional 
Chernoff "/'conventional moment", "conventional Klar" are ones by the one-sided 
confidence interval using respective bounds (see Section [3. 1.2b . Note that "con- 
ventional Chernoff" and "conventional moment" almost overlap. Parameters are 
channel parameter ^ = 0.1 (see Eq. (fT9l)), £pe = 10 -5 . 

with the conventional channel estimation over the amplitude damping channel, for 
example from Fig. 1, when the sample size is 10 7 , about 20% higher than Y^. 
However, from Fig. 2, the accurate estimate is the smallest over the depolarizing 
channel. 

Observe that the accurate channel estimation (with relative entropy) gives the 
worse estimate than the conventional channel estimation with relative entropy, for 
all samples sizes over the depolarizing channels, though their asymptotic limits 
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of min Sp AB (X\E) are the same as shown in H30H . In the authors' opinion, this is 
because the accurate channel estimation has to estimate the larger number of pa- 
rameters and the accuracy of estimate is degraded by the increase in the number 
of parameters. Note that the number of parameters is 7 for the accurate chan- 
nel estimation and 1 for the conventional one. On the other hand, the accurate 
channel estimation gives better estimates with larger sample sizes over the ampli- 
tude damping channel. This is because the asymptotic limit of the accurate chan- 
nel estimation is much larger than the conventional one, as shown in [|30l . while 
the accurate channel estimation also experiences the degradation by the increased 
number of parameters with smaller sample sizes as well. Since the asymptotic 
limit of the accurate channel estimation is always larger than the conventional one 
if the channel is not Pauli one ||29l , the accurate channel estimation is expected to 
work better when the channel is supposed to be non-Pauli and the sample size for 
channel estimation is large. 

4 Conclusion 

The accurate channel method non-asymptotically increases the key rate over the 
amplitude damping channel. Thus, we should not discard mismatched measure- 
ment outcomes in that case. However, the key rate non-asymptotically depreciates 
over the depolarizing channel. On the other hand, in the conventional channel es- 
timation, the non-asymptotic key rate shown by Scarani et al. is improved by 
reconstructing the confidence interval for a channel using the one-sided interval 
estimation with tail probability bounds. One-sided intervals can improve the key 
rate in the following order of tail probability bounds: the variational distance, the 
relative entropy, Chernoff bound, factorial moment bound, Klar bound. 
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